Current Development

Current Objective

Post-UAT phase: sonan-digital CRM v1.0 is feature-complete and in production. SONAN QMS is live on Cloudflare. Current focus is deploying the QMS Help module, updating sonan-docs, and planning sonan-digital v1.1 (deferred HIGH-* issues + QuickBooks).

Current Milestone — Post-v1.0 / Pre-v1.1

Item	Status
sonan-digital CRM v1.0 feature-complete	✅ Done
UAT environment live (uat.sonandigital.com)	✅ Done
sonan-qms Help & Guide module	✅ Committed (9a4f0a8) — wrangler deploy pending
sonan-docs QMS guide (8 HTML pages)	✅ Files ready — git push pending
sonan-digital v1.1 (HIGH-1, 4, 6, 7)	⏳ Not started
QuickBooks integration	⏳ Deferred

Recently Completed

sonan-qms — QMS Help Module (2026-07-20)

File	Change
apps/web/src/pages/help/helpContent.ts	NEW — 880-line guide content: 7 sections, 40+ subsections covering all routes. Defect state machine, role permissions, API keys, troubleshooting, 24-term glossary.
apps/web/src/pages/help/HelpPage.tsx	NEW — 464-line help UI: client-side search, TOC sidebar, hash deep linking, prev/next, mobile overlay, keyboard shortcut (/).
apps/web/src/App.tsx	Added /help and /help/* routes with lazy-loaded HelpPage
apps/web/src/components/layout/Sidebar.tsx	Added BookOpen "Help & Guide" nav item below PLATFORM_NAV with separator

Commit 9a4f0a8 pushed to sonan-qms. Build: 2033 modules, 4.22s, 0 TypeScript errors.

sonan-digital CRM — Post-UAT Features (2026-07-03 → 2026-07-16)

59 commits shipped across 8 major feature areas. All on main and in production.

Feature	Description	Date
Invoice PDF	.eml download opens native email client with invoice PDF attached. No server-side email required.	2026-07-07
Corporate Documents	Internal corporate documents module: folder manager, document detail, Move to Folder action. Full-width layout. Theme support. Wiki articles added.	2026-07-11 – 07-16
Security / MFA	Security & MFA module shipped.	2026-07-12
IAM — Access Management UI	Roles, permissions, users, and audit log UI. Client portal access UI: invite, status, resend, reset, revoke flows.	2026-07-13
IAM — Phase 3A+3B Enforcement	Global permission registry. assertPermission() on all 118 API routes. usePermissions() React hook. Sidebar items driven by SIDEBAR_PERMISSIONS. Server-side page guards on all admin pages.	2026-07-14
Business Apps	Business Apps module shipped and integrated into navigation.	2026-07-13
Business Registry	Business Registry module with view modals on all 4 entity tabs.	2026-07-14
VSA — Vendors, Subscriptions & Assets	Full VSA module: Vendors, Subscriptions, Assets CRUD. Relationship model with 4-role ownership (Owner/Admin/Manager/User), consumers, client assignments. Reports, dashboard widgets, mobile card views, SSR. Legal entity filter. Renamed subscriptions → vendor_subscriptions to avoid Stripe conflict.	2026-07-14 – 07-15
Portfolio (Our Work) + Internal Files	Portfolio module (Our Work) and Internal Files module. Solutions Showcase + Document Folders feature merged.	2026-07-15
Global AppFooter + Config	src/config/app.ts centralizes app metadata. Global AppFooter component on all pages.	2026-07-15
Security fixes	Tenant isolation on project/support/lead DELETE routes. Super-admin cross-tenant bypass. Broken delete dialogs fixed.	2026-07-10

Known Bugs (Open — v1.1 Target)

ID	Severity	Summary	Target
HIGH-1	High	No custom rate limiting on API routes (Supabase Auth built-in only)	v1.1
HIGH-4	High	Silent email delivery failures, no retry queue	v1.1
HIGH-6	High	Signed document download URLs expire after 1 hour	v1.1
HIGH-7	High	No TOTP recovery codes — locked-out user requires admin reset	v1.1

Deferred Work

• Upstash rate limiting on API routes (HIGH-1)
• Email delivery retry queue (HIGH-4)
• Long-lived signed URLs for documents (HIGH-6)
• TOTP recovery codes (HIGH-7)
• QuickBooks integration
• Multi-agency SaaS onboarding flow

Next Recommended Tasks

1. Push sonan-docs — git add qms*.html nav.js && git commit -m "feat: add QMS user guide" && git push from sonan-docs folder
2. Deploy sonan-qms frontend — verify Cloudflare Pages project name, run npx wrangler pages deploy dist --project-name <correct-name>
3. sonan-digital v1.1 planning — Upstash rate limiting is the highest-impact open item
4. QuickBooks integration — deferred from v1.0

Production Readiness

Area	Status	Notes
Core CRM modules	✅ Production-ready	All modules implemented and on main
IAM & permissions	✅ Production-ready	Phase 3A+3B enforcement on all 118 routes + sidebar
Corporate Documents	✅ Production-ready	Folders, detail, Move to Folder, theme support
VSA (Vendors/Subscriptions/Assets)	✅ Production-ready	Full module with relationship model, reports, mobile
Business Registry & Business Apps	✅ Production-ready	All tabs with view modals
Portfolio & Internal Files	✅ Production-ready	Our Work + Internal Files modules shipped
Client portal	✅ Production-ready	Full invite flow, access UI, revoke
Employee portal	✅ Production-ready	Theme fixed, all features working
Authentication & MFA	✅ Production-ready	TOTP MFA, session management (no recovery codes yet)
Email notifications	✅ Production-ready	8+ transactional email types (no retry queue yet)
Stripe payments	✅ Production-ready	Checkout, webhooks, auto-paid status
Rate limiting	⚠️ Partial	Supabase Auth built-in only; no app-level rate limits
Audit log	✅ Implemented	logAudit() + admin UI page
SONAN QMS	✅ Live	Cloudflare Pages/Workers. Help module committed (deploy pending).

Important Notes

• The dev branch deploys to uat.sonandigital.com. The main branch deploys to production.
• sonan-qms git commits must use the FUSE-safe plumbing pattern (write to /tmp, hash via Python, build trees with Python helpers). Never use git add on the FUSE-mounted path.
• The sandbox cannot push to GitHub — Adnan always pushes from the Windows terminal.
• sonan-docs is plain HTML (no MkDocs). To update: edit HTML files, run standard git add / commit / push from Windows terminal.